search

hasherezade / hollows_hunter

Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
https://github.com/hasherezade/hollows_hunter/wiki
BSD 2-Clause "Simplified" License
2.03k stars 253 forks source link

Compiling issue using Cmake #4

Closed moosa-aslam closed 4 years ago

moosa-aslam commented 5 years ago

Unable to compile Hollow's hunter.

123

hasherezade commented 5 years ago

The CMake files are fine (also AppVeyor uses them and builds the project without any problems: https://ci.appveyor.com/project/hasherezade/hollows-hunter/build/job/f9s45l81glo93jdi). There is some mistake on your side.

First of all, I can see that you downloaded just a master, which is not the complete source. You should have clone it along with the submodules.

Please follow this small guide:

  1. clone the full repository recursively (you must have git installed): 
    git clone --recursive https://github.com/hasherezade/hollows_hunter.git

clone

  1. As a result you should have the following directory with the complete sources:

sources_dir

In the complete sources, the directory pe-sieve have is not empty.

  1. Once you have the complete sources cloned, you must point the root directory of the source to CMake.

select_dir

  1. Click configure, and choose a proper build environment. I recommend Visual Studio. There are many options, but you MUST make sure that you choose the option that you have installed on your machine.

choose_vs

When I choose Visual Studio 2015, which is not installed on my machine, I get exactly the same error.

invalid

Once you chosen the wrong thing, you must first delete the cache to be able to correct your mistake.

File -> Delete Cache

After deleting the cache, choose again the valid one. Once you will have the correct environment set, I ensure you that it will work.

moosa-aslam commented 5 years ago

Followed your guide

1) Configured and generated project. Compiler PIN-2019-09-02-09-34-19

2) Project folder looks like this Compiler PIN-2019-09-02-09-35-05

3) Project Errors Compiler PIN-2019-09-02-09-47-40

hasherezade commented 5 years ago

ok, so the first problem is resolved and project got generated.

With the second thing - you seem to be having outdated version of the Windows SDK, where the definitions of delay load imports are missing... I saw such case before, and there are some workarounds. But I need to be sure. What exactly is your OS and the visual Studio version? Can you possibly switch to the newer?

moosa-aslam commented 5 years ago

ok, so the first problem is resolved and project got generated.

With the second thing - you seem to be having outdated version of the Windows SDK, where the definitions of delay load imports are missing... I saw such case before, and there are some workarounds. But I need to be sure. What exactly is your OS and the visual Studio version? Can you possibly switch to the newer?

Windows 7 64 Bit Visual Studio 2010

yes I can visual studio 2012 should do the work ?

hasherezade commented 5 years ago

You can try, but it may not be enough. You may also try to install Visual Studio 2017 or above. In case if you don't have a system on which you can install a higher version of Visual Studio you can use Windows 10 downloaded from here.

moosa-aslam commented 5 years ago

After compiling on Visual Studio 2012

1- Cmake (generated using VS 2012 generator) Compiler PIN-2019-09-02-17-05-12

2- Visual Studio 2012 Compiler PIN-2019-09-02-17-05-37

hasherezade commented 5 years ago

As far as I can see, it is the same issue as before, with missing definition of delayload imports. Can you try with the second solution that I proposed?

hasherezade commented 5 years ago

I made adjustments to support the old SDKs. Try to update the project along with its submodules:

git pull --recurse-submodules
git submodule update --remote --recursive

or, delete the project and download it again:

git clone --recursive https://github.com/hasherezade/hollows_hunter.git

and repeat all the steps that I mentioned in the small guide. Let me know if it helped.